Privacy Policy

Dr. SaHaab Diagnostics — www.drsahaab.com

Effective Date: 01 October 2026

Medolution Healthcare Private Limited (“Company”, “Dr. SaHaab”, “we”, “us”, or “our”), having its registered office at 183-P, Ground Floor – B, Sector 52, Gurugram, Haryana – 122003, India, is the Data Fiduciary in respect of the personal data processed through www.drsahaab.com and its associated mobile application (together, the “Platform”), as that term is defined under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). This Privacy Policy (“Policy”) sets out, in plain and accessible language, what personal data we collect, the purposes for which and legal basis on which it is processed, how it is protected, with whom it may be shared, and the rights available to you as a Data Principal.

This Policy applies to all visitors to, and registered users of, the Platform, and to any individual whose personal data is submitted to the Platform by another person on their behalf (for example, a family member booking a diagnostic test for a parent or child). This Policy is incorporated into, and must be read together with, our Terms and Conditions. Capitalised terms used but not defined in the body of this Policy have the meanings assigned to them in Section 1 (Definitions) below.

1. Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below, and cognate expressions shall be construed accordingly:

• "AI Interpretation" means the automated, algorithm-generated summary, flagging, or analysis of a diagnostic or pathology report or other health information uploaded by a User, provided as a decision-support aid and not as a substitute for professional medical advice or diagnosis.
• "Company / Data Fiduciary" means Medolution Healthcare Private Limited, which alone or in conjunction with others determines the purpose and means of processing Personal Data through the Platform.
• "Consent" means a User's or Data Principal's free, specific, informed, unconditional, and unambiguous indication of agreement to the processing of their Personal Data through a clear affirmative action, obtained in the manner required under Section 6 of the DPDP Act.
• "Data Principal" means the individual to whom the Personal Data relates, and, where such individual is a child, includes the parent or lawful guardian of that child, and, where such individual is a person with disability, includes their lawful guardian, in each case acting on the Data Principal's behalf.
• "Data Processor" means any person, including our Service Providers, payment gateway partners, logistics and communication partners, and cloud and AI infrastructure providers, who processes Personal Data on our behalf and strictly on our documented instructions.
• "Data Protection Board" means the Data Protection Board of India established under Section 18 of the DPDP Act.
• "DPDP Act" means the Digital Personal Data Protection Act, 2023, together with the rules, regulations, and notifications issued thereunder from time to time.
• "Grievance Officer" means the officer designated by the Company under Section 8(9) of the DPDP Act to address grievances of Data Principals, as identified in Section 16 of this Policy.
• "HCP" means a Healthcare Provider, being a registered medical practitioner, doctor, or clinician who provides teleconsultation or advisory services to Users through the Platform.
• "Health Data" means any Personal Data related to the physical or mental health of a Data Principal, including prescriptions, pathology and diagnostic reports, symptoms, medical history, and AI Interpretations, which the Company treats with heightened safeguards consistent with the standard applicable to “Sensitive Personal Data or Information” under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• "IT Act" means the Information Technology Act, 2000, together with the rules made thereunder.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under Section 2(t) of the DPDP Act.
• "Platform" means the website located at www.drsahaab.com and the Dr. SaHaab mobile application, together with all sub-domains, features, and services made available thereon.
• "Processing" means in relation to Personal Data, a wholly or partly automated operation or set of operations performed on digital Personal Data.
• "Service(s)" means the diagnostic test booking, home sample collection, report delivery, AI Interpretation, teleconsultation, and related healthcare-support services made available through the Platform.
• "Service Provider" means an empanelled diagnostic laboratory, sample-collection centre, or radiology centre that performs a test booked through the Platform.
• "User" means any natural person who accesses, browses, registers on, or transacts through the Platform, whether on their own behalf or on behalf of another individual.

2. Scope and Application

This Policy governs the collection, use, storage, disclosure, and transfer of Personal Data by the Company in connection with the Platform and the Services. It applies irrespective of the device or channel used to access the Platform, including our website, mobile application, WhatsApp Business channel, and customer-support telephone lines.

This Policy does not apply to:

1. Information collected by any third party, including through any application, content, or advertisement that may link to or be accessible from the Platform, which is governed by that third party's own privacy policy; or
2. Anonymised or aggregated data from which no individual is, or can reasonably be, identified.

By accessing or using the Platform, or by submitting Personal Data to us, you acknowledge that you have read and understood this Policy. Where processing is based on Consent, your continued use of the Platform following any material update to this Policy, after having been notified of such update in accordance with Section 17, will constitute your acknowledgment of the revised Policy; however, fresh, explicit Consent will separately be sought wherever required by law before any new or materially different processing of Sensitive Personal Data or Health Data commences.

3. Information We Collect

3.1 Information you provide directly

1. Identity and contact data: name, gender, date of birth, mobile number, e-mail address, and residential or sample-collection address.
2. Health Data: prescriptions, pathology and diagnostic reports, symptoms, medical history, and other information you upload or share for the purpose of booking a test, obtaining an AI Interpretation, or consulting an HCP. Health Data is processed only on the basis of your explicit, informed Consent and is subject to the heightened safeguards described in Sections 3 and 10.
3. Payment data: transaction identifiers, order value, and payment status shared with us by our payment gateway partners. We do not collect, store, or have access to your full card number, CVV, or net-banking credentials, which are captured directly by our RBI-regulated payment gateway partners.
4. Account data: your login credentials, or, where you choose social login, the identifiers provided by Google or LinkedIn.
5. Communications: the content of messages you send us via WhatsApp, in-app chat, e-mail, or telephone, including when you contact customer support or our AI Assistant.

3.2 Information collected automatically

1. Device and usage data: IP address, browser type and version, device identifiers, operating system, pages visited, and time spent on the Platform, collected through cookies and similar technologies as described in Section 8.
2. Location data: your approximate or precise location, collected only with your permission, to identify Service Providers near you and to enable home sample collection in your area.

We do not knowingly collect Personal Data beyond what is reasonably necessary for the purposes described in Section 4, and we encourage you not to submit Personal Data relating to any other individual unless you are authorised to do so on their behalf.

4. Purposes and Legal Basis of Processing

We process Personal Data only for specified, lawful purposes disclosed to you, and, in respect of Health Data, only on the basis of your explicit, informed Consent, in accordance with the DPDP Act. We use your Personal Data to:

1. Create and administer your account, and to process test bookings, home sample collection, and payments.
2. Share the minimum Personal Data necessary with the relevant Service Provider and HCP to fulfil your booking or consultation.
3. Generate the AI Interpretation of an uploaded report, including processing by automated systems and, where applicable, by third-party AI infrastructure providers acting strictly as our Data Processors and subject to contractual confidentiality obligations.
4. Send booking confirmations, appointment reminders, report-delivery notifications, and, only where you have not opted out, service updates and promotional communications.
5. Respond to support queries, investigate and resolve complaints, prevent and detect fraud, and enforce our Terms and Conditions.
6. Comply with legal, regulatory, or statutory obligations applicable to us, including under the Clinical Establishments (Registration and Regulation) Act, 2010 (where applicable in the relevant State), Indian Council of Medical Research (ICMR) guidelines on biomedical research and data, and requests from law-enforcement or statutory authorities made through due process of law.

We do not use Health Data to make any automated decision that produces a legal effect or otherwise significantly affects you (such as a denial of Service) without a meaningful opportunity for human review; see further Section 12.

5. Consent and Withdrawal of Consent

1. By registering on, or submitting Personal Data to, the Platform, you provide informed Consent to the collection and processing described in this Policy, given in the manner required under Section 6 of the DPDP Act, including through a clear affirmative action and an itemised notice of the Personal Data sought and the purpose of processing.
2. Where processing is based on your Consent, you may withdraw it at any time, with an ease comparable to the ease with which it was given, by writing to support@drsahaab.com. Withdrawal of Consent does not affect the lawfulness of processing carried out before such withdrawal, and may result in our being unable to continue providing the specific Service that depended on that Personal Data.
3. Where processing is necessary to comply with a legal obligation, or falls within a “legitimate use” recognised under Section 7 of the DPDP Act, such processing may continue notwithstanding withdrawal of Consent, to the extent and for so long as permitted by law.

6. Sharing and Disclosure of Personal Data

We do not sell your Personal Data. We share Personal Data only in the following circumstances and, in each case, only to the extent reasonably necessary for the stated purpose:

1. With Service Providers and HCPs, strictly to the extent necessary to fulfil your booking, sample collection, report delivery, or consultation.
2. With payment gateway providers and logistics and communication partners (including WhatsApp Business API and SMS gateway providers) engaged as our Data Processors under written confidentiality, data-protection, and security obligations.
3. With cloud-hosting and AI infrastructure providers who process Personal Data solely on our documented instructions to operate the Platform and to generate AI Interpretations.
4. With corporate clients, where you access the Platform through a corporate wellness programme, limited strictly to the Personal Data necessary for administering that programme and as separately consented to by you.
5. Where required by a court order, a statutory or regulatory authority, a law-enforcement agency acting under due process of law, or as otherwise required or permitted by applicable law, or to establish, exercise, or defend legal claims.
6. In connection with a merger, acquisition, corporate restructuring, or sale of business assets, provided that the acquiring or surviving entity is bound to materially equivalent privacy protections as set out in this Policy.

Every Data Processor engaged by us is bound by a written agreement obliging it to process Personal Data only on our instructions, to implement appropriate technical and organisational security measures, and to assist us in complying with our obligations under the DPDP Act, including in respect of Data Principal rights and breach notification.

7. Cross-Border Transfer of Personal Data

Your Personal Data is primarily stored on servers located within India. Where a Data Processor (such as a cloud-hosting or AI infrastructure provider) processes Personal Data outside India, such transfer is made only to a country or territory that has not been restricted by the Central Government by notification under Section 16 of the DPDP Act, and only under contractual safeguards obliging the recipient to maintain a standard of protection consistent with this Policy and applicable law.

8. Cookies and Tracking Technologies

We use cookies, web beacons, SDKs, and similar technologies to keep you signed in, to remember your preferences (such as your selected city), and to understand aggregate usage patterns so as to improve the Platform. These technologies may be first-party (set by us) or third-party (set by analytics or advertising partners acting as our Data Processors).

You can control or disable cookies at any time through your browser or device settings. Please note that disabling certain categories of cookies may limit Platform functionality, such as your saved location, cart contents, or login persistence.

9. Data Retention

1. Booking and payment records are retained for the period required under applicable tax, accounting, and consumer-protection laws, which is generally up to eight (8) years for financial records.
2. Health Data and reports you upload are retained for as long as your account remains active, or for as long as is necessary to provide the Service, following which such data is securely deleted or anonymised, unless a longer retention period is required by law or is necessary for a pending grievance, audit, or legal claim.
3. You may request earlier deletion of your Personal Data under Section 11 below, subject to any overriding legal retention requirement.
4. Where the purpose for which Personal Data was collected is no longer being served and retention is not otherwise necessary for legal or compliance purposes, we will erase or anonymise such Personal Data within a reasonable period, consistent with our obligations under Section 8(7) of the DPDP Act.

10. Data Security

We implement reasonable security practices and procedures, as mandated under the IT Act, including encryption of Personal Data in transit, role-based access controls, network security monitoring, and restriction of internal access to Health Data on a strict need-to-know basis. Access to Health Data by our personnel and Data Processors is logged and periodically audited.

No method of transmission over the internet, or method of electronic storage, is entirely secure. While we take commercially reasonable and legally mandated steps to protect your Personal Data, we cannot guarantee its absolute security, and you acknowledge and accept this inherent limitation when you use the Platform.

11. Rights of Data Principals

Subject to the DPDP Act and the rules made thereunder, and to any applicable exemptions, you have the right to:

1. Right to access information: obtain a summary of the Personal Data we hold about you, the processing activities undertaken, and the identities of the Data Processors with whom such Personal Data has been shared.
2. Right to correction and erasure: request the correction, completion, or updating of inaccurate or outdated Personal Data, and request erasure of Personal Data that is no longer necessary for the purpose for which it was collected.
3. Right to grievance redressal: file a grievance with our Grievance Officer in the first instance and, if such grievance remains unresolved, thereafter with the Data Protection Board.
4. Right to withdraw consent: withdraw Consent at any time, in the manner and subject to the consequences described in Section 5.
5. Right to nominate: nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, by writing to us at support@drsahaab.com.

To exercise any of these rights, please write to support@drsahaab.com with sufficient information to enable us to verify your identity and locate the relevant Personal Data. We will acknowledge and respond to such requests within the timelines prescribed under applicable law. We may decline a request, in whole or in part, where permitted by the DPDP Act, and will provide reasons for doing so.

12. Automated Decision-Making

Certain Services, including the AI Interpretation, involve automated processing of the Health Data you upload. The AI Interpretation is provided solely as a decision-support tool and does not constitute a medical diagnosis, and does not, by itself, determine your eligibility to receive any Service. We do not subject you to any automated decision that produces a legal effect concerning you, or that similarly significantly affects you, without offering you a meaningful opportunity to seek human review of that decision; any request for such review may be made to support@drsahaab.com.

13. Personal Data Breach Notification

In the event of a personal data breach that is likely to affect you, we will notify the Data Protection Board and affected Users of the nature, extent, and likely consequences of the breach, and of the measures being taken to mitigate the risk arising therefrom, in the manner and within the timeframe prescribed under the DPDP Act and the rules made thereunder.

14. Children's Data and Persons with Disability

Where a booking or account relates to an individual below eighteen (18) years of age, verifiable Consent of the parent or lawful guardian is required before we process that child's Personal Data, and such processing is limited strictly to what is necessary to provide the Service. We do not knowingly process a child's Personal Data for behavioural monitoring, tracking, or targeted advertising directed at children, and we do not process Personal Data in a manner that is likely to cause any detrimental effect on the well-being of a child.

Where an individual is a person with disability who has a lawful guardian, references in this Policy to Consent given by, and rights exercisable by, the Data Principal shall be read as Consent given by, and rights exercisable by, such lawful guardian on their behalf, in accordance with the DPDP Act.

15. Third-Party Links and Services

The Platform may contain links to third-party websites, payment gateways, or social media pages that are not owned or controlled by us. We are not responsible for, and this Policy does not extend to, the privacy or data-handling practices of such third parties. We encourage you to review the privacy policy of any third-party website or service before submitting Personal Data to it.

16. Grievance Redressal

In accordance with Section 8(9) of the DPDP Act, we have designated a Grievance Officer to address your queries and grievances relating to the processing of your Personal Data. The particulars of the Grievance Officer are set out below:

Name: [Grievance Officer Name] — to be designated by the Company
Designation: Grievance Officer, Medolution Healthcare Private Limited
Email: support@drsahaab.com
Phone: +91 85275 06066
Address: 183-P, Ground Floor – B, Sector 52, Gurugram, Haryana – 122003, India

Complaints will be acknowledged within forty-eight (48) hours of receipt and, where possible, resolved within one (1) month of receipt. If you are not satisfied with our resolution, or if we fail to address your grievance within the prescribed timeline, you may escalate the grievance to the Data Protection Board of India.

17. Amendments to this Policy

We may update this Policy periodically to reflect changes in our practices, the Services, or applicable law. The updated version will be posted on this page with a revised “Last Updated” date, and, where the changes are material, we will provide a more prominent notice, such as by e-mail or an in-app notification. Where a material change affects the manner in which Sensitive Personal Data or Health Data is used, we will, where required by law, notify you separately and seek fresh Consent before such change takes effect.

18. Governing Law and Dispute Resolution

This Policy is governed by the laws of India, including the IT Act and the DPDP Act. Any dispute arising out of or in connection with this Policy shall be subject to the governing law, jurisdiction, and dispute resolution mechanism set out in our Terms and Conditions.

19. Contact Us

If you have any questions, concerns, or feedback regarding this Policy or our data-processing practices, please write to us at support@drsahaab.com or at our registered office address set out in Section 16 above.